JP4623437B2 - Authentication system, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication system, an authentication method, and an authentication program, and more particularly to an authentication system including an apparatus used by a plurality of users such as an image forming apparatus, an authentication method in the system, and an authentication program.

  Processing apparatuses (hereinafter referred to as image forming apparatuses) having a copy function, a printer function, a scanner function, and the like are widely used. This image forming apparatus may store documents including confidential information, and measures to increase security are necessary to prevent leakage of confidential information. Therefore, authentication information such as a password is set in advance, and when the image forming apparatus is used, the authentication information is requested to be entered, and the authenticated user is permitted to use the image forming apparatus.

  Here, if the same authentication information is used for a long time, the authentication information is leaked and security cannot be maintained, so that the authentication information is appropriately changed by the user. In this case, the user who has changed the authentication information can input the latest authentication information and use the image forming apparatus, but other users who do not know that the authentication information has been changed can input the old authentication information. As a result, the use of the image forming apparatus is rejected. Therefore, in order to avoid such a problem, a method has been proposed in which old authentication information can be authenticated under certain conditions.

  For example, in Patent Document 1 below, only when one of the old and new two-generation passwords sent from the monitoring center matches the password held by the terminal when the terminal is connected to the monitoring center with a line between them, Discloses a method for performing data communication.

  Also, in Patent Document 2 below, a password change request is accepted for an authorized user, a new password is set and an old password is retained by a password change process, and an authentication request from the user is received next time. On the other hand, a method is disclosed in which an old password is discarded if a new password is requested, and conditional permission is granted if the old password is used.

JP-A-5-30103 JP 2000-82044 A

  However, as described in Patent Documents 1 and 2, in the method of permitting the use of the apparatus when either old or new authentication information is input, two types of authentication information are accepted. When the authentication information is acquired, measures such as changing the authentication information become meaningless.

  On the other hand, if one of the users changes the authentication information in an environment where the authentication information is shared by multiple users, as described above, the other users cannot use the device and check the authentication information. It takes a long time to find a corrective action, such as entering information many times or searching for authentication information change contact information.

  The present invention has been made in view of the above problems, and its main object is to provide an authentication system, an authentication method, and an authentication program capable of appropriately dealing with a change in authentication information while ensuring security. There is to do.

In order to achieve the above object, the present invention provides an authentication system including an apparatus whose use is restricted by authentication processing based on authentication information, and compares the input authentication information with pre- registered authentication information. A determination unit that notifies a message indicating that the authentication information has been changed when the authentication information is not the latest authentication information and is authentication information that has been previously set, and the authentication information that has been previously set for each, and a selection unit that allows selection or or not to notify the message, the determination unit, when the authentication information selected to the effect that notifies the message has been is entered In addition, the message is notified.

  Further, in the present invention, the message specifies information specifying a user who has changed to the latest authentication information, information specifying a date and time when the user has changed to the latest authentication information, and a method for acquiring the latest authentication information. It can be set as the structure containing the information to do.

Further, the present invention provides an authentication method using the authentication information in an authentication system including an apparatus whose use is restricted by an authentication process based on the authentication information, the first step of registering the latest authentication information, and an input The second step of inputting authentication information by the unit, the authentication information input by the determination unit and the authentication information registered in advance , and the input authentication information is not the latest authentication information, and And at least a third step of notifying a message indicating that the authentication information has been changed when the authentication information has been previously set. In the first step, the selection unit sets the previously set authentication information. for each authentication information, select whether or not to notify the message, in the third step, the authentication information input selection indicating that notifies the message has been If it is intended to notify the message.

The present invention also provides an authentication program that operates in a system including a device whose use is restricted by an authentication process based on authentication information, and compares a computer with input authentication information and pre- registered authentication information. A determination unit that notifies a message indicating that the authentication information has been changed when the input authentication information is not the latest authentication information and is the authentication information that has been previously set; against each of the authentication information, selection unit that allows selection or or not to notify the message, to function as the determination unit, the authentication information input selection indicating that notifies the message has been When the message is received, the message is notified.

  According to the authentication system, authentication method, and authentication program of the present invention, it is possible to appropriately cope with a change in authentication information while ensuring security.

  The reason is that a determination unit is provided in the authentication system, and the determination unit compares the input authentication information with the authentication information stored in advance, and if the input authentication information is the latest authentication information, use of the device is performed. If it is permitted and the authentication information is not the latest, it is determined whether the authentication information has been set before. If the authentication information has been set before, a message indicating that the authentication information has been changed is notified and updated. This is because a hint for acquiring the authentication information is presented, and control for rejecting the use of the apparatus is performed unless the authentication information is set previously.

  As shown in the background art, in a system including an apparatus used by a plurality of users, authentication information such as a password is used, and the authentication information is appropriately changed in order to ensure security. In that case, if both new and old authentication information is accepted, measures such as changing the authentication information become meaningless. On the other hand, if old authentication information is not accepted at all, other users will spend time to obtain the latest authentication information, and the convenience will be significantly deteriorated.

  Therefore, in the present embodiment, when old authentication information is input, the old authentication information is not accepted unconditionally or the old authentication information is not accepted at all. Send a message. Thereby, it is clearly transmitted that the authentication information has been changed, and the handling time can be shortened.

  At that time, by notifying the information that identifies the user who has changed to the latest authentication information as a message, it becomes clear who the user should confirm the latest authentication information, so that the response time can be shortened Can do. In this case, since new authentication information is confirmed with an administrator-level user whose authentication information can be changed, acquisition of authentication information through an unauthorized route can be prevented.

  In addition, the user can confirm the latest authentication information by notifying, as a message, information specifying the date and time of change to the latest authentication information and a method for obtaining the latest authentication information. Because it becomes clear, it is possible to shorten the handling time.

  It is also possible to eliminate users who know only generations of previous authentication information by making it possible to select which authentication information of previously set authentication information is notified when a message is input. Yes, security can be increased. Further, by making it possible to select which device to notify the message, the message can be notified to the computer terminal of the user who has input the authentication information, and security can be improved. Further, convenience can be improved by making it possible to select a method for notifying a message.

  In order to describe the above-described embodiment of the present invention in more detail, an authentication system, an authentication method, and an authentication program according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a diagram schematically illustrating a configuration of an authentication system according to an embodiment of the present invention, and FIG. 2 is a block diagram illustrating a configuration of a portion related to authentication of an image forming apparatus. FIGS. 3 to 5 are diagrams showing an example of the configuration of the screen displayed on the display unit of the authentication system of this embodiment, and FIGS. 6 and 7 are flowcharts showing the procedure of the authentication method of this embodiment. FIG.

  As shown in FIG. 1, the authentication system 10 of this embodiment includes a computer terminal 20 of one or a plurality of clients that instruct printing, and one or a plurality of image forming apparatuses 30 such as a network printer or a multifunction peripheral that executes printing. These are connected to each other via a communication network 40 such as a LAN (Local Area Network) or a WAN (Wide Area Network).

  In FIG. 1, the authentication system 10 is configured by the computer terminal 20 and the image forming apparatus 30, but the authentication system 10 may be configured by only the image forming apparatus 30. In this case, both the input of authentication information and the notification of a message indicating that the authentication information has been changed may be performed by the image forming apparatus 30. Further, the apparatus to be authenticated is not limited to the image forming apparatus 30 and may be a processing apparatus that performs an arbitrary process. Further, the authentication process of this embodiment may be executed by a management server or the like.

  FIG. 2 is a block diagram showing a configuration related to authentication of the present embodiment in the configuration of the image forming apparatus 30. A CPU (Central Processing Unit) 31, a ROM (Read Only Memory) 32, and a RAM (Random Access). Memory) 33, storage unit 34, operation unit 35, display unit 36, determination unit 37, and the like.

  The CPU 31 functions as a control unit that develops and executes a control program stored in the ROM 22 in the RAM 33 and performs various controls of the image forming apparatus 30.

  The storage unit 34 is a nonvolatile storage medium using an HDD (Hard Disk Drive) or the like, and stores authentication information and the like. The authentication information includes a password set last (referred to as the latest password) and one or more old passwords (referred to as old passwords) set before that.

  The operation unit 35 is configured with a touch panel or the like, and enables input of an ID, a password, a message to be notified, and the like.

  The display unit 36 includes an LCD (Liquid Crystal Display) or the like, and displays a password input screen, a password change screen, an error notification change screen, and the like, which will be described later.

  The determination unit 37 compares the password input from the operation unit 35 with a password registered in advance in the storage unit 34. When the input password is the latest password, the use of the image forming apparatus 30 is permitted. If it is not the latest password, it is determined whether it is the old password, and if it is the old password, a message indicating that the password has been changed is displayed on the display unit 36. When the input password is neither the latest password nor the old password, the use of the image forming apparatus 30 is refused by displaying that the password is incorrect.

  The determination unit 27 may be configured as hardware in the image forming apparatus 30, or may be configured as an authentication program that causes a computer to function as the determination unit 27, and the authentication program is configured in the authentication system 10 such as the image forming apparatus 30. It is good also as a structure operated on the apparatus to perform.

  In this embodiment, the authentication information is stored in the storage unit 34 of the image forming apparatus 30. However, the authentication information is stored in an arbitrary device (an apparatus that can be referred to by the determination unit 37) in the authentication system 10. It only has to be done.

  In this embodiment, authentication is performed using a password. However, authentication may be performed using a keystroke pattern (information on a time interval for pressing a key), biometric information such as a fingerprint or a vein, Authentication may be performed in the order of fingerprint input. Further, authentication may be performed using an IC card, magnetic card, RFID (Radio Frequency Identification) tag or the like in which an ID and a password are stored in advance.

  Next, an authentication method in the authentication system 10 of the present embodiment will be described using the screens of FIGS. 3 to 5 as examples.

  FIG. 3 is an example of a password input screen 51 displayed on the display unit 36 (or the display unit of the computer terminal 20) of the image forming apparatus 30. The password input screen 51 is a column for inputting a department ID, a password, and the like ( [A] column in the figure), a message input column ([B] column in the figure), and a software keyboard that functions as the operation unit 35.

  The user of the image forming apparatus 30 can use the image forming apparatus 30 by correctly inputting the department ID and password. At this time, if it is not the latest password but the old password set before, a message notifying that the password has been changed is displayed in the message column. When changing the password, the password change screen 52 shown in FIG. 4 is popped up by pressing the [Change Password] button.

  FIG. 4 shows an example of the password change screen 52. The password change screen 52 includes a field for inputting a user ID and password to be changed, a department ID, a password before change (old password), and a password after change ( A latest password) field, a software keyboard that functions as the operation unit 35, and the like.

  The password changer inputs [changer ID] and [changer password] registered in advance. Next, the user can change to a new password by inputting [Department ID], [Old Password], and [New Password] and pressing the [OK] button. Also, by pressing the [Detail] button, an error notification change screen 53 shown in FIG. 5 is popped up.

  FIG. 5 shows an example of the error notification change screen 53. The error notification change screen 53 includes a column for inputting a department ID ([1] column in the figure) and a column for displaying detailed setting information related to a password ([2] in the figure). ] Field) and a field for correcting the detailed setting information relating to the selected password ([4] field in the figure).

  First, when [Department ID] of [1] is selected from the pull-down menu, a list (see [2]) in which the user can change settings is displayed. In the case of an administrator, it is preferable to display a list of all setters for the purpose of list management. When the password is changed, for example, [Authentication Permission]: [No Permission], [Display Location]: [Device], [Notification Contents]: [Password has been changed by Mr. XX. Please check. ] Is automatically registered in the list (see [3]).

  To change the setting contents, place the cursor on the list to change the setting, and the currently set [authentication permission], [display location], and [notification contents] are displayed in the [4] column. In the figure, setting information on the second line (shaded line) is displayed.

  When changing [Authentication Allowed], select [Allow] or [Disallow] from the pull-down menu (see [5]). In the example of FIG. 5, since “Allow” is set, “Display location” and “Notification content” are displayed. Note that if it is set to [Not Allowed], the image forming apparatus 30 cannot be used with this password as in the conventional case, and no message is notified.

  Similarly, when changing [Display Location], select [Device] or [Terminal] from the pull-down menu (see [6]). When [Apparatus] is selected, a message is displayed on the image forming apparatus 30, and when [Terminal] is selected, a message is displayed on the computer terminal 20.

  [Notification content] can be edited by text editing (see [7]). For example, in [7], a method for obtaining the latest password is notified, such as checking an email sent from the user who has changed to the latest password. This notification content can be set arbitrarily, and may be any information that can be used as a hint for obtaining the latest password. For example, as shown in [3], it may be information that identifies the user who has changed to the latest password. Information specifying the date and time when the password was changed to the latest password may be used, or information may be arbitrarily combined.

  The list can also be deleted by pressing [Delete List].

  Note that, here, the configuration is such that [authentication permission], [display location], and [notification content] are set for each message, but the setting items are not limited to these. Although the message is displayed on the screen here, a message notification method can be set. For example, the message is generated from a speaker or the like provided in advance in the image forming apparatus 30 or the computer terminal 20. You can also.

  As described above, when the password is input on the password input screen 51, if the input password is not the latest password and the old password, a message indicating that the password has been changed is notified. The latest password can be obtained by referring to the message. In addition, on the error notification change screen 53, it is possible to set the action when the old password is input, the display location of the message, and the notification content of the message, so appropriate control is performed no matter how many times the password is changed. Can do.

  Next, a specific procedure of the authentication method in the authentication system 10 of the present embodiment will be described with reference to the flowchart diagrams of FIGS. The authentication of this embodiment may be executed only by the image forming apparatus 30 or may be executed by the computer terminal 20 and the image forming apparatus 30. Hereinafter, it demonstrates individually.

[When executed only by the image forming apparatus 30]
The authentication procedure in this case is as shown in the flowchart of FIG. It is assumed that the latest password and the old password are registered in the storage unit 34 of the image forming apparatus 30 in advance.

  First, in step S101, the control unit of the image forming apparatus 30 displays the password input screen 51 of FIG. 3 on the display unit 36, and accepts the input of the department ID and password in the [A] column.

  Next, in step S <b> 102, the determination unit 37 checks whether the input password matches the latest password registered in advance in the storage unit 34.

  If the passwords match, the use of the image forming apparatus 30 is permitted in step S106. If the passwords do not match, in step S103, the determination unit 37 checks whether the input password matches the old password registered in the storage unit 34.

  If it does not match the old password, the use of the image forming apparatus 30 is not permitted in step S107. If it matches the old password, in step S104, the determination unit 37 determines whether the authentication permission (information displayed in [5] in FIG. 5) for the old password is [Allow] or [No]. To check.

  If “not permitted” is set, the use of the image forming apparatus 30 is not permitted in step S107. If it is set to [Allow], in step S105, the determination unit 37 determines whether the display location for the old password (information displayed in [6] in FIG. 5) is [Device] or [Terminal]. Check if it exists.

  If it is [terminal], the use of the image forming apparatus 30 is not permitted in step S107. If it is [apparatus], the notification content for the old password (information displayed in [7] in FIG. 5) is displayed in the [B] column of the password input screen 51 in FIG.

[When executed by the image forming apparatus 30 and the computer terminal 20]
The authentication procedure in this case is as shown in the flowchart of FIG. It should be noted that the shaded steps in the figure are processes executed by the computer terminal 20. Further, it is assumed that the latest password and the old password are registered in the storage unit 34 of the image forming apparatus 30 in advance.

  First, in step S301, the control unit of the computer terminal 20 displays the password input screen 51 of FIG. 3 on the display unit, accepts the input of the department ID and password in the [A] field, and in step S302, the image forming apparatus 30. Send the department ID and password entered to.

  In step S <b> 201, the image forming apparatus 30 receives the department ID and password from the computer terminal 20.

  Next, in step S <b> 202, the determination unit 37 checks whether the password received from the computer terminal 20 matches the latest password registered in advance in the storage unit 34.

  If the passwords match, the use of the image forming apparatus 30 is permitted in step S206. If the passwords do not match, the determination unit 37 checks whether or not the received password matches the old password registered in the storage unit 34 in step S203.

  If it does not match the old password, the use of the image forming apparatus 30 is not permitted in step S207. If it matches the old password, in step S204, the determination unit 37 determines whether the authentication permission for the old password (information displayed in [5] in FIG. 5) is [Allow] or [No]. To check.

  If “not permitted” is set, the use of the image forming apparatus 30 is not permitted in step S207. If it is set to [Allow], in step S205, the determination unit 37 determines whether the display location for the old password (information displayed in [6] in FIG. 5) is [Device] or [Terminal]. Check if it exists.

  In the case of [device], the notification content (information displayed in [7] in FIG. 5) for the old password is displayed on the display unit 36. The display method is arbitrary. For example, the password input screen 51 in FIG. 3 can be displayed, and the notification content can be displayed in the [B] column.

  If it is [terminal], in step S209, the notification content for the old password is transmitted to the computer terminal 20 that transmitted the department ID and password. The computer terminal 20 receives the notification content from the image forming apparatus 30 in step S303, and displays the received notification content on the display unit in step S304.

  Thus, the user who has input the old password can confirm that the password has been changed by the notified message, and can acquire the latest password and then use the image forming apparatus 30 by attempting to use it again. It is possible to cope with the change of the password appropriately. In addition, since a message is not displayed for a user who has entered a password that is neither the latest password nor the old password, unauthorized use of the image forming apparatus 30 can be prevented and security can be ensured.

  In the above embodiment, the authentication system 10 including the image forming apparatus 30 has been described as an example. However, the present invention is not limited to the above embodiment, and any processing apparatus used by a plurality of users can be used. The same can be applied to the including system.

  The present invention is applicable to a system including a processing apparatus such as an image forming apparatus used by a plurality of users, an authentication method in the system, and an authentication program.

It is a figure which shows typically the structure of the authentication system which concerns on one Example of this invention. 1 is a block diagram illustrating a configuration of a portion related to authentication of an image forming apparatus according to an embodiment of the present invention. FIG. It is an example of the screen (password input screen) displayed on the display part of the image forming apparatus (or computer terminal) which concerns on one Example of this invention. It is an example of the screen (password change screen) displayed on the display part of the image forming apparatus (or computer terminal) which concerns on one Example of this invention. It is an example of the screen (error notification change screen) displayed on the display unit of the image forming apparatus (or computer terminal) according to an embodiment of the present invention. It is a flowchart figure which shows the specific procedure of the authentication method in the authentication system (in the case of only an image forming apparatus) concerning one Example of this invention. It is a flowchart figure which shows the specific procedure of the authentication method in the authentication system (in the case of an image forming apparatus and a computer terminal) concerning one Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Authentication system 20 Computer terminal 30 Image forming apparatus 31 CPU
32 ROM
33 RAM
34 storage unit 35 operation unit 36 display unit 37 determination unit 40 communication network 51 password input screen 52 password change screen 53 error notification screen

Claims (12)

In an authentication system including a device whose use is restricted by authentication processing based on authentication information,
The authentication information entered is compared with the authentication information registered in advance, and the authentication information is changed when the input authentication information is not the latest authentication information and is previously set authentication information. A determination unit that notifies a message indicating that,
For each of the previously set authentication information, and a selection unit that allows selection or or not to notify the message,
The determination unit, an authentication system authentication information selected to the effect of notifying the message has been the case with the input notifies the message, it is said.   The authentication system according to claim 1, wherein the message includes information for specifying a user who has changed to the latest authentication information.   The authentication system according to claim 1, wherein the message includes information for specifying a date and time when the message is changed to the latest authentication information.   The authentication system according to claim 1, wherein the message includes information for specifying a method for acquiring the latest authentication information. An authentication method using the authentication information in an authentication system including an apparatus whose use is restricted by authentication processing based on authentication information,
A first step of registering the latest authentication information;
A second step of inputting authentication information by the input unit;
The determination unit compares the input authentication information with the pre- registered authentication information, and when the input authentication information is not the latest authentication information and is the authentication information set previously, And at least a third step of notifying a message indicating that the authentication information has been changed,
In the first step, by the selection unit, for each of the set authentication information to the previously select whether or not to notify the message,
Wherein in the third step, the authentication method that the authentication information selected to the effect that notifies the message has been that if it is entered, and notifies the message, it is said.   The authentication method according to claim 5, wherein the message includes information specifying a user who has changed to the latest authentication information.   The authentication method according to claim 5 or 6, wherein the message includes information for specifying a date and time when the message is changed to the latest authentication information.   The authentication method according to claim 5, wherein the message includes information specifying a method for acquiring the latest authentication information. An authentication program that operates in a system including a device whose use is restricted by an authentication process based on authentication information,
Computer
The authentication information entered is compared with the authentication information registered in advance, and the authentication information is changed when the input authentication information is not the latest authentication information and is previously set authentication information. A determination unit that notifies a message indicating that,
For each of the previously set authentication information, selection unit that allows selection or or not to notify the message, to function as,
The determination unit, authentication program authentication information selected to the effect of notifying the message has been that if it is entered, and notifies the message, it is said.   The authentication program according to claim 9, wherein the message includes information for specifying a user who has changed to the latest authentication information.   11. The authentication program according to claim 9, wherein the message includes information specifying a date and time when the message is changed to the latest authentication information.   12. The authentication program according to claim 9, wherein the message includes information for specifying a method for acquiring the latest authentication information.

Images